BRIEFRansomwarehighP72
Whitearmor publishes Whirlpool data leak
Whirlpool Corporation
Detected23 October 2026 · 17:15 UTC
Whitearmor listed Whirlpool, a ~$15.5B appliance manufacturer, claiming 4,577 employee records from three plants, 374 corporate emails, roughly 22,000 SAP invoice records and full plant contact lists. SAP invoice and manager/cost-center data directly enable invoice fraud and targeted phishing against suppliers and staff. The named plants and AD-style usernames also give attackers a roadmap for internal reconnaissance.
CategoryRansomware
Severityhigh
Priority score72
Detected23 October 2026 · 17:15 UTC
Ransomware● 50
Ransomware Aurora publica a la consultora suiza ARX GroupThe Aurora group added ARX Group SA, a Swiss engineering consultancy with federal infrastructure contracts (SBB, tunnels, transit), to its leak site. Stolen fee structures and project data could aid extortion and reveal critical-infrastructure vendors. Though outside LATAM, the infrastructure relevance makes this a notable fresh victim to track.Ransomware● 62
Ransomware LockBit5 publica a la firma española ZelsiorLockBit5 added Zelsior, a Spanish technology-driven legal debt-recovery firm, to its leak site. Such firms handle sensitive debtor and financial data, so a breach risks large-scale PII and regulatory exposure under GDPR. It is a fresh regional ransomware victim that defenders and Spanish clients should track for data-dump publication.Ransomware● 68
Qilin publica a la argentina MaxiSeguridadThe Qilin ransomware group has added MaxiSeguridad, an Argentine professional services company, to its leak site. A fresh regional victim matters because private security and services providers typically hold sensitive client data and privileged access to customer environments. Even without published file details yet, extortion of this profile often escalates into data leaks affecting third parties.Ransomware● 76
Whitearmor publica a la logística J.B. HuntWhitearmor published J.B. Hunt, a major North American logistics company, claiming 140,838 employee records with PII and national IDs, 1.7M carrier contacts, 38.2M invoices and 973 M365 mailboxes, with a $5M demand. The volume of identity and financial data makes business email compromise, supplier fraud and credential stuffing highly likely. The same leak is being promoted on BreachForums as a downloadable collection.Ransomware● 65
Qilin ransomware publica a Revi Group de MéxicoThe Qilin group added Revi Group, a Mexican organization, to its ransomware leak site. Publication signals a claimed breach with data theft and likely encryption of internal systems. Any Mexican victim in the region is relevant for defenders monitoring Qilin's LATAM activity and potential credential or data reuse.Ransomware● 72
Qilin publica a la transportista chilena Aerotop como víctimaQilin has named Aerotop, a Chilean transportation company, on its extortion leak site. For a logistics/transport operator, exposed data can include operational systems, client contracts and route or shipment records. Disruption to such a firm can ripple through Chilean transport and supply chains, warranting exposure checks.